Providers must ensure those responsible for security are competent and resourced, including to perform the monitoring duties of reg.6 and to appraise supplier activity and recommendations; and, when a supplier provides new equipment, ensure it is set up to a secure configuration approved by trained security personnel in a demonstrable way, recording any failure to follow the supplier's essential security recommendations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.